Problem z allyrics, wyskakujące reklamy i linki

katelbinka · 22 Maj 2014 08:12

raporty z OTL

http://www.wklej.org/id/1369052/

http://www.wklej.org/id/1369053/

fiesta · 22 Maj 2014 08:13

katelbinka proszę zapoznaj się z tym poradnikiem:

http://forum.dobreprogramy.pl/forum-15/ogloszenie-2-poradnik-zakładania-i-edycji-tematu/

a następnie zmień tytuł wątku na konkretny. W treści posta proszę podać przyczyny zamieszczenia logów i opisać ogólne objawy infekcji.

Zignorowanie prośby będzie skutkować usunięcie topica z forum.

Atis · 22 Maj 2014 08:21

W panelu sterowania odinstaluj:

Spybot - Search & Destroy 2

Spyware Terminator

WebCake 3.00

AVG Security Toolbar

AllLyrics

Ominent toolbar

vShare.tv plugin 1.3

weDownload Manager Pro

WinZipper

Pobierz i uruchom AdwCleaner Kliknij Szukaj i później Usuń.

Pobierz Farbar Recovery Scan Tool 64-Bit Version

Uruchom FRST i kliknij Scan. Pokaż raport FRST i Addition.

katelbinka · 22 Maj 2014 08:57

raporty:http://www.wklej.org/id/1369091/http://www.wklej.org/id/1369092/

Atis · 22 Maj 2014 09:29

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-588957766-262620424-1261502463-1008\User: Group Policy restriction detected <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=466acce0-90a2-11e1-a491-0026184643f4&q={searchTerms}
SearchScopes: HKCU - {361A90B1-EB18-423C-B0AC-AEB9100F00A1} URL = http://asp.usatoday.com/search/yahoo/search.aspx?qt=both&nr=5&kw={searchTerms}
SearchScopes: HKCU - {45DAFD83-9412-43DE-AB7C-65F685591D67} URL = http://sitesearch.timesonline.co.uk/sitesearch/jsp/Search/Search.jsp?SEARCH_TEXT={searchTerms}
SearchScopes: HKCU - {59B4F2DB-4880-4C56-8E15-372ABD543232} URL = http://search.indiatimes.com/websearch.cms?query={searchTerms}&GO=GO
SearchScopes: HKCU - {83FC4C36-0787-41A4-ADFA-62198B5FD994} URL = http://searchresults.news.com.au/servlet/Search?site=ninews&queryterm={searchTerms}&searchoption=yes
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR Extension: (No Name) - C:\Users\Q\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2013-08-23]
C:\AdwCleCaner
C:\Program Files (x86)\Spybot - Search & Destroy 2
C:\ProgramData\Spybot - Search & Destroy
C:\Users\Q\AppData\Local\Temp\*.dll
C:\Users\Q\AppData\Local\Temp\*.exe
C:\Program Files (x86)\Spyware Terminator
Task: {2463606A-7C08-4D37-B231-3230466B0BA9} - \Desk 365 RunAsStdUser No Task File <==== ATTENTION
Task: {41DABA3F-7B71-49EA-BDF9-E9EE4AAAA526} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{5CAEB1D5-468E-43EA-9B72-53A84ED9CD06}.exe
Task: {8B07397B-CA35-4665-BADB-EAD1232CED85} - \FreeHDSport TV-updater No Task File <==== ATTENTION
Task: {D8E59E95-BDFE-4AAA-94F7-7A5840E2EFFC} - \FreeHDSport TV-codedownloader No Task File <==== ATTENTION
Task: {FDFD40A1-BD0A-4C8B-9F19-C67990341CAE} - \FreeHDSport TV-enabler No Task File <==== ATTENTION
Task: {FF6D48CC-28F0-46C2-B983-B9E427E849AB} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{EDF0DBAB-8749-4C59-BC73-15077979C7BB}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{EDF0DBAB-8749-4C59-BC73-15077979C7BB}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{5CAEB1D5-468E-43EA-9B72-53A84ED9CD06}.exe
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpywareTerminatorShield" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpywareTerminatorUpdater" /f

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.